Show hint to impersonators that app-tokens cannot be created

[MaxFlax]

Running Nextcloud 13

When impersonating a user and trying to create app-token
the token is created but you cant change the username impersonated.

It keeps the impersonators username instead of the user impersonated.

[cuthulino]

+1
Found same problem.

[rullzer]

Yeah it won't be possible to create apptokens when impersonating.

To create an apptoken you need the password of the user. But you don't have that when impersonating. Also note that there is no way to obtain it since the password is not stored accesisable in the DB.

[HorlogeSkynet]

Hey over here !

It is pretty frustrating to encounter this behavior from the security page itself (and it definitely looks like a bug !).
Should we display a message about this when the administrator lands on the impersonated user's security section, and definitely close this issue ?

Thanks 🙇‍♂️
Bye 👋

EDIT : Ping #10

[blizzz]

Should we display a message about this when the administrator lands on the impersonated user's security section, and definitely close this issue ?

Yeah, this would be an improvement. Let me change the topic.

[Rick26L]

Hi @blizzz ,

so it would not be possible again to create these App Token/QR Codes as an Admin for a user while impersonate him?
In v19 and before it worked good and was a really good for helping the remote users to get the nextcloud running on an mobile device etc.

[thopico]

Hi,
not sure if this is the appropriate place to communicate this behavior but it seems related. Tell me if I should open a new issue.

As I didn't know impersonators can't create app token (no field in web UI), I tried through cli.
The function asked for the user impersonated's password, I entered a wrong one but anyway the system generated a valid token (it's been revoked since) :

occ user:add-app-password ***
Enter the user password: 
The password has not been validated, some features might not work as intended.
app password:
XAH4REqp1UIGhwb7BmBdJd9t8JBCY9jXNqRUvGkSX4tNYkZ3r6XhuFEFefLopvZxJvUgzT5i

I checked and it shows up on web UI and can be used.

Is it voluntary ?

ps: I'm running NC 23.0.10

[blizzz]

@thopico yes, it is unrelated here, and it is not a bug, but working as expecting, citing »The password has not been validated, some features might not work as intended.«